Kubernetes Container Orchestration Service Mesh 5 — Questions and Answers
Question 1: What is the primary advantage of using a service mesh over adding resilience logic directly in application code?
- Meshes are faster than in-process libraries
- Meshes decouple infrastructure concerns from business logic so any language or framework benefits (Correct answer)
- Meshes eliminate the need for Kubernetes
- Meshes automatically scale applications based on traffic
Correct answer: Meshes decouple infrastructure concerns from business logic so any language or framework benefits
A service mesh moves retry, timeout, circuit-breaking, and observability logic to the infrastructure layer so polyglot applications get these features without code changes.
Question 2: What happens to traffic in a mesh when a circuit breaker is 'open'?
- All traffic is retried with exponential backoff
- Requests to the unhealthy service are immediately rejected without forwarding (Correct answer)
- Traffic is rerouted to an identical backup service
- The pod is restarted by the kubelet
Correct answer: Requests to the unhealthy service are immediately rejected without forwarding
When a circuit breaker is open, the proxy immediately returns an error to the caller without attempting to reach the failing service, preventing cascade failures.
Question 3: Which resource would you create in Istio to route 90% of traffic to v1 and 10% to v2 of a service?
- DestinationRule with weighted clusters
- VirtualService with weighted routes (Correct answer)
- HorizontalPodAutoscaler with ratio settings
- NetworkPolicy with percentage selectors
Correct answer: VirtualService with weighted routes
A VirtualService can define weighted routing rules that split traffic between multiple subsets defined in a DestinationRule.
Question 4: What is 'SPIFFE' and how does it relate to service meshes?
- A load balancing algorithm used by Envoy
- A standard for issuing cryptographic identities to workloads, used by meshes for mTLS (Correct answer)
- A Kubernetes admission webhook for mesh injection
- An observability protocol for distributed tracing
Correct answer: A standard for issuing cryptographic identities to workloads, used by meshes for mTLS
SPIFFE (Secure Production Identity Framework for Everyone) defines how workload identities are issued as SVIDs, which service meshes use for mTLS authentication.
Question 5: In Consul Connect, what is the role of 'intentions'?
- Define deployment rollout strategies
- Control which services are allowed to communicate with each other (Correct answer)
- Configure health check thresholds for services
- Specify resource limits for sidecar proxies
Correct answer: Control which services are allowed to communicate with each other
Intentions in Consul Connect are authorization rules that define which source services are permitted to establish connections to destination services.
Question 6: What does 'header-based routing' in a service mesh allow you to do?
- Route requests to different service versions based on HTTP header values (Correct answer)
- Add security headers to all outbound responses
- Compress HTTP headers to reduce latency
- Inject tracing headers automatically into all requests
Correct answer: Route requests to different service versions based on HTTP header values
Header-based routing matches on specific HTTP headers (e.g., user-agent, x-version) to route requests to different backends, enabling feature flags and A/B testing.
Question 7: Which metric is NOT typically provided out-of-the-box by a service mesh?
- Request success rate (HTTP 2xx percentage)
- P99 request latency between services
- Number of database rows returned per query (Correct answer)
- Requests per second between service pairs
Correct answer: Number of database rows returned per query
Service meshes operate at the network/HTTP layer and cannot introspect application-level data like database row counts without custom instrumentation.
Kubernetes Container Orchestration Service Mesh 5
What is the primary advantage of using a service mesh over adding resilience logic directly in application code?